CVE-2024-1968
published 2024-05-20CVE-2024-1968: In scrapy/scrapy, an issue was identified where the Authorization header is not removed during redirects that only change the scheme (e.g., HTTPS to HTTP) but…
PriorityP340high7.5CVSS 3.0
AVNACLPRNUINSUCHINAN
EPSS
0.68%
49.0th percentile
In scrapy/scrapy, an issue was identified where the Authorization header is not removed during redirects that only change the scheme (e.g., HTTPS to HTTP) but remain within the same domain. This behavior contravenes the Fetch standard, which mandates the removal of Authorization headers in cross-origin requests when the scheme, host, or port changes. Consequently, when a redirect downgrades from HTTPS to HTTP, the Authorization header may be inadvertently exposed in plaintext, leading to potential sensitive information disclosure to unauthorized actors. The flaw is located in the _build_redirect_request function of the redirect middleware.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | python-scrapy | < python-scrapy 2.11.2-1 (forky) | python-scrapy 2.11.2-1 (forky) |
| scrapy | scrapy | <= 1.8.4 | — |
| scrapy | scrapy | >= 0 < 2.11.2 | 2.11.2 |
| scrapy | scrapy | >= 2.0.0 < 2.11.2 | 2.11.2 |
| scrapy | scrapy_scrapy | >= unspecified < 2.11.2 | 2.11.2 |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
osv7.5HIGH
vendor_debian7.5HIGH
vendor_ubuntu5.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
python-scrapy vulnerabilities
osv·2025-05-05·CVSS 6.5
CVE-2021-41125 [MEDIUM] python-scrapy vulnerabilities
python-scrapy vulnerabilities
It was discovered that Scrapy improperly exposed HTTP authentication
credentials to request targets, including during redirects. An attacker
could use this issue to gain unauthorized access to user accounts. This
issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-41125)
It was discovered that Scrapy did not remove the cookie header during
cross-domain redirects. An attacker could possibly use this issue to gain
unauthorized access to user accounts. This issue only affected Ubuntu 18.04
LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-0577)
It was discovered that Scrapy inefficiently parsed XML content. An
attacker could use this issue to cause a denial of service by sending a
crafted XML response. This issue only affected Ubuntu 18.0
OSV
CVE-2024-1968: In scrapy/scrapy, an issue was identified where the Authorization header is not removed during redirects that only change the scheme (e
osv·2024-05-20·CVSS 7.5
CVE-2024-1968 [HIGH] CVE-2024-1968: In scrapy/scrapy, an issue was identified where the Authorization header is not removed during redirects that only change the scheme (e
In scrapy/scrapy, an issue was identified where the Authorization header is not removed during redirects that only change the scheme (e.g., HTTPS to HTTP) but remain within the same domain. This behavior contravenes the Fetch standard, which mandates the removal of Authorization headers in cross-origin requests when the scheme, host, or port changes. Consequently, when a redirect downgrades from HTTPS to HTTP, the Authorization header may be inadvertently exposed in plaintext, leading to potential sensitive information disclosure to unauthorized actors. The flaw is located in the _build_redirect_request function of the redirect middleware.
GHSA
Scrapy leaks the authorization header on same-domain but cross-origin redirects
ghsa·2024-05-14
CVE-2024-1968 [MEDIUM] CWE-200 Scrapy leaks the authorization header on same-domain but cross-origin redirects
Scrapy leaks the authorization header on same-domain but cross-origin redirects
### Impact
Since version 2.11.1, Scrapy drops the `Authorization` header when a request is redirected to a different domain. However, it keeps the header if the domain remains the same but the scheme (http/https) or the port change, all scenarios where the header should also be dropped.
In the context of a man-in-the-middle attack, this could be used to get access to the value of that `Authorization` header
### Patches
Upgrade to Scrapy 2.11.2.
### Workarounds
There is no easy workaround for unpatched versions of Scrapy. You can replace the built-in redirect middlewares with custom ones patched for this issue, but you have to patch them yourself, manually.
### References
This security issue was reporte
OSV
Scrapy leaks the authorization header on same-domain but cross-origin redirects
osv·2024-05-14
CVE-2024-1968 [MEDIUM] Scrapy leaks the authorization header on same-domain but cross-origin redirects
Scrapy leaks the authorization header on same-domain but cross-origin redirects
### Impact
Since version 2.11.1, Scrapy drops the `Authorization` header when a request is redirected to a different domain. However, it keeps the header if the domain remains the same but the scheme (http/https) or the port change, all scenarios where the header should also be dropped.
In the context of a man-in-the-middle attack, this could be used to get access to the value of that `Authorization` header
### Patches
Upgrade to Scrapy 2.11.2.
### Workarounds
There is no easy workaround for unpatched versions of Scrapy. You can replace the built-in redirect middlewares with custom ones patched for this issue, but you have to patch them yourself, manually.
### References
This security issue was reporte
Ubuntu
Scrapy vulnerabilities
vendor_ubuntu·2025-05-05·CVSS 5.7
CVE-2024-3574 [MEDIUM] Scrapy vulnerabilities
Title: Scrapy vulnerabilities
Summary: Several security issues were fixed in python-scrapy.
It was discovered that Scrapy improperly exposed HTTP authentication
credentials to request targets, including during redirects. An attacker
could use this issue to gain unauthorized access to user accounts. This
issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-41125)
It was discovered that Scrapy did not remove the cookie header during
cross-domain redirects. An attacker could possibly use this issue to gain
unauthorized access to user accounts. This issue only affected Ubuntu 18.04
LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-0577)
It was discovered that Scrapy inefficiently parsed XML content. An
attacker could use this issue to cause a denial of service by sendi
Debian
CVE-2024-1968: python-scrapy - In scrapy/scrapy, an issue was identified where the Authorization header is not ...
vendor_debian·2024·CVSS 7.5
CVE-2024-1968 [HIGH] CVE-2024-1968: python-scrapy - In scrapy/scrapy, an issue was identified where the Authorization header is not ...
In scrapy/scrapy, an issue was identified where the Authorization header is not removed during redirects that only change the scheme (e.g., HTTPS to HTTP) but remain within the same domain. This behavior contravenes the Fetch standard, which mandates the removal of Authorization headers in cross-origin requests when the scheme, host, or port changes. Consequently, when a redirect downgrades from HTTPS to HTTP, the Authorization header may be inadvertently exposed in plaintext, leading to potential sensitive information disclosure to unauthorized actors. The flaw is located in the _build_redirect_request function of the redirect middleware.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 2.11.2-1)
sid: resolved (fixed in 2.11.2-1)
trixie: resolved (fixed in 2.11.2-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-05-20
Published